Insufficient Input Validation in Cisco's Evolved Programmable Network Manager and Prime Infrastructure

CVE-2025-20269

What is CVE-2025-20269?

A vulnerability exists in the web-based management interface of Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure, allowing authenticated, low-privileged remote attackers to retrieve arbitrary files from the device's underlying file system. This security gap arises from insufficient input validation in certain HTTP requests, enabling attackers to exploit the flaw through crafted requests. Successful exploits may lead to unauthorized access to sensitive files, posing a significant risk to the security of affected devices.

References